Multiple weak signals
StrongSeveral weak signals in the package metadata: new-package, repo-mismatch.
Why it mattersSeveral small signals in one file add up.
What to doRead that file before installing.
Example reportScorecard Findings Behaviour and tool surface
Supply chain and hardened setup
Second opinion
imgdecode
An npm package reported as malicious by security researchers.
AgentArmorHQ · Risk Report
imgdecode 1.0.3 · npm
Malicious
Malicious behaviour found: Our research lists this exact package as malicious. This package does something harmful on purpose. Severity: critical.
Eight dimensions
Each score comes from what the published files do, not from the README. Rules set every number; the review cannot raise or lower one.
What we found, with evidence
Only behaviour that points to intent is listed here. Ordinary capabilities are in the next section.
4findings
Certain · 1Strong · 1Weak · 2
Step-by-step execution and data-flow chain
No exfil chainStep-by-step trace: This package loads cleanly without install-time exfiltration or hidden command decoding (on-demand import only, no credential reads, offline / no fixed hosts).
1. Entry & triggerOn-demand import only
Nothing executes during install; code runs only when imported or called as a tool.
2. Secret & file reachNo credential reads
Does not read SSH keys, cloud credential stores, or sensitive environment variables.
3. Execution & deobfuscationPlain static source
All code is plain readable text; no runtime eval, Base64 decoding, or shell spawning.
4. Network destinationOffline / no fixed hosts
No fixed external network endpoints or data-collection hosts detected.
Known malicious package
CertainOur research lists this exact package as malicious.
Why it mattersOur research lists this as malicious.
What to doDo not install it. If you did, remove it and rotate any credentials on that machine.
Minor signals
- WeakRegistry metadata: new package first published 2026-09-30
- WeakRegistry metadata: repo mismatch no repository url, has install script
Our research
- Reported maliciousMALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon17 Oct 2026
In short. Our research and our code analysis both point to harmful behaviour. Treat this as malicious.
What it can do
Many good packages do these things. They are listed so you know what you are installing, and red ones tie into a finding.
Agent and tool surface
| Surface area | Observed behaviour | Status |
|---|---|---|
| Directive & instruction surface | No hidden directives, prompt poisoning, or cross-tool overrides detected in package text. | Clean |
| Context & token footprint | No always-on MCP tool definitions or agent prompt files measured in this package. | Clean |
| Credential & environment reach | No direct credential store or bulk environment reads flagged. | Clean |
| Process & install execution | No install hooks or shell execution traces found. | Clean |
| External network surface | No fixed external network hosts found in static analysis. | Clean |
Capabilities
- Ships a native binary
When you install it
- Install
Nothing runs.
Network destinations
No fixed network destinations found in the code.
Command and payload X-Ray (decoded)
No install commands, encoded blobs, or shell execution traces were found in the published files.
Dependencies and provenance
0 direct dependencies. None are flagged.
| Check | Result | Outcome |
|---|---|---|
| Lookalike names (a fake copy of a popular package) | 0 of 0 | Pass |
| Installed from a URL instead of the registry | 0 | Pass |
| Known malware advisories (dependencies) | 0 | Pass |
| Declared but never imported, or brand new | 0 | Pass |
| Published files match the source repository | No mismatch found | Pass |
| Maintainer changed since the last version | Not flagged | Pass |
| Registry metadata | new package, repo mismatch | Note |
Containment and removal actions
This package is flagged. Follow the removal and credential-rotation steps below immediately.
Immediate removal command
bash
# DO NOT INSTALL imgdecode@1.0.3 — remove immediately if present:
npm uninstall imgdecode- Do not install or load this package in any workspace.
- If it was installed on any machine, remove it and rotate every API key, token, and SSH credential stored on that machine.
- Check outbound network logs for any hosts listed in the Network destinations table above.
Review
Two separate reviewers read the evidence on their own. They can confirm intent, but they cannot clear a certain finding or set a grade.
First review
SuspiciousConfidence60%
The package was published very recently, has an install script with no linked repository, and ships a native binary. The README also advertises an exec() helper that runs an arbitrary './tool.exe', which does not obviously fit a pure image-decoding purpose. No install script body or decoder source was provided, so there is no direct evidence of malicious behaviour. A human should inspect the install script and the native binary before trusting it.
Independent second review
SuspiciousConfidence55%
The package claims to be an image decoder but its README documents an `exec` function that runs arbitrary executables (`./tool.exe`), which doesn't fit that purpose. It ships a Windows-only native PE binary, has an install script (the registry metadata lists one, though the install hooks field shows none), has no repository, and was first published very recently. These all raise concern. However, the scanner shows no concrete payload, network endpoint, or credential access, so I can't confirm malicious behaviour. A human should review the native binary and the install script.
How this report is made
We read the published files as text and never run, install or import them. Rules turn what the code does into findings, and every grade comes only from those findings. Letter grades: A is 90 and up, B 75, C 60, D 40, F below 40. The overall grade is a weighted average with harmful intent counting most, and it follows the intent score when that falls below 50. Engine version 2.5.2.
0 / 712clean popular packages flagged high
360 / 461real malware caught high or critical
~4 stime to finish a check
Based on public adoption and transparency signals as of Oct 19, 2026. Our opinion, not a code audit or security guarantee. It can miss things, so use it as one input to your own decision.